Fixed in
Check your version
traefik versionCVEs affecting 2.0
| CVE | Title | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-44487 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can... | 7.5 | KEV | 100.0% | 2023-10-10 |
| CVE-2024-45410 | HTTP client can remove the X-Forwarded headers in Traefik | 9.8 | — | 2024-09-20 | |
| CVE-2026-85595 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 Authentication Bypass via digestAuth | 9.3 | — | 2026-09-04 | |
| CVE-2025-32431 | Traefik has a possible vulnerability with the path matchers | 8.8 | — | 2025-04-22 | |
| CVE-2026-88009 | Traefik: Rootless HTTP/1 request-target routes as "/" but is forwarded verbatim, bypassing path-scoped routing... | 8.8 | — | 2026-09-11 | |
| CVE-2023-54365 | Traefik - Denial of Service via HTTP/2 Request Handling | 8.7 | — | 2026-06-23 | |
| CVE-2026-85597 | Traefik before v2.11.55 and v3.0.0 through v3.7.10 mTLS Bypass via TLS Option Conflict | 8.2 | — | 2026-09-04 | |
| CVE-2022-46153 | Routes exposed with an empty TLSOption in traefik | 8.1 | — | 2022-12-09 | |
| CVE-2026-32305 | Traefik mTLS bypass via fragmented ClientHello SNI extraction failure | 7.8 | — | 2026-03-20 | |
| CVE-2026-35051 | Traefik: ForwardAuth trustForwardHeader=false allows spoofed X-Forwarded-Prefix to bypass auth | 7.8 | — | 2026-05-01 | |
| CVE-2026-39858 | Traefik: Forwarded alias spoofing top pre-auth decision bypass | 7.8 | — | 2026-05-01 | |
| CVE-2026-40912 | Traefik: StripPrefixRegex auth bypass via Path/RawPath desync | 7.8 | — | 2026-05-01 | |
| CVE-2026-48020 | Traefik StripPrefix Route-Level Auth Bypass via Path Normalization | 7.8 | — | 2026-06-24 | |
| CVE-2026-53622 | Traefik: HTTP/3 mTLS bypass via exact SNI TLSOptions lookup for wildcard and mixed-case hosts | 7.8 | — | 2026-06-24 | |
| CVE-2026-54763 | Traefik: headerField underscore-variant identity spoofing in BasicAuth / DigestAuth / ForwardAuth | 7.8 | — | 2026-07-07 | |
| CVE-2026-65600 | Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex | 7.8 | — | 2026-07-22 | |
| CVE-2020-9321 | configurationwatcher.go in Traefik 2.x before 2.1.4 and TraefikEE 2.0.0 mishandles the purging of certificate... | 7.5 | — | 2020-03-17 | |
| CVE-2019-20894 | Traefik 2.x, in certain configurations, allows HTTPS sessions to proceed without mutual TLS verification in a... | 7.5 | — | 2020-07-03 | |
| CVE-2022-39271 | Traefik HTTP/2 connections management could cause a denial of service | 7.5 | — | 2022-10-11 | |
| CVE-2023-29013 | HTTP header parsing could cause a deny of service | 7.5 | — | 2023-04-15 | |
| CVE-2023-47633 | Uncontrolled Resource Consumption in Traefik | 7.5 | — | 2023-12-05 | |
| CVE-2024-28869 | Possible denial of service vulnerability with Content-length header in Traefik | 7.5 | — | 2024-04-13 | |
| CVE-2024-39321 | Traefik vulnerable to bypassing IP allow-lists via HTTP/3 early data requests in QUIC 0-RTT handshakes | 7.5 | — | 2024-07-06 | |
| CVE-2026-25949 | Traefik: TCP readTimeout bypass via STARTTLS on Postgres | 7.5 | — | 2026-02-13 | |
| CVE-2026-26999 | Traefik: tcp router clears read deadlines before tls forwarding, enabling stalled handshakes (slowloris doS) | 7.5 | — | 2026-03-06 | |
| CVE-2022-23632 | Traefik skips the router TLS configuration when the host header is an FQDN | 7.4 | — | 2022-02-17 | |
| CVE-2025-54386 | Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution | 7.3 | — | 2025-08-02 | |
| CVE-2026-121966 | Traefik before 2.11.60 and 3.7.16 ForwardAuth NTLM/Negotiate Identity Leak | 7.0 | — | 2026-11-05 | |
| CVE-2026-71324 | Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool | 7.0 | — | 2026-08-07 | |
| CVE-2026-85594 | Traefik v3.7.1 crossProviderNamespaces Bypass via Service Middleware | 7.0 | — | 2026-09-04 | |
| CVE-2026-114635 | Traefik before v2.11.58 and v3.7.14 SNI Check Bypass via HTTP/2 Scheme | 7.0 | — | 2026-10-22 | |
| CVE-2025-66490 | Traefik doesn't Prevent Path Normalization Bypass in Router + Middleware Rules | 6.9 | — | 2025-12-09 | |
| CVE-2026-41181 | Traefik: Errors middleware forwards Authorization and Cookie headers to separate error page service | 6.9 | — | 2026-05-16 | |
| CVE-2026-54764 | ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader... | 6.9 | — | 2026-07-07 | |
| CVE-2026-114656 | Traefik before 2.11.58 and 3.7.13 mTLS Bypass via Negated Host Matcher | 6.9 | — | 2026-10-22 | |
| CVE-2026-44774 | Traefik: Gateway API TraefikService backend accepts rest@internal, allowing unauthorized exposure of the REST... | 6.4 | — | 2026-05-16 | |
| CVE-2026-112778 | Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations | 6.4 | — | 2026-10-20 | |
| CVE-2024-52003 | X-Forwarded-Prefix Header still allows for Open Redirect in traefik | 6.3 | — | 2024-11-30 | |
| CVE-2026-32595 | Traefik: BasicAuth Middleware Timing Attack Allows Username Enumeration | 6.3 | — | 2026-03-20 | |
| CVE-2026-32695 | Traefik has Knative Ingress Rule Injection that Allows Host Restriction Bypass | 6.3 | — | 2026-03-27 | |
| CVE-2026-41263 | Traefik: BasicAuth middleware: timing side-channel vulnerability | 6.3 | — | 2026-05-01 | |
| CVE-2026-29777 | Traefik has a kubernetes gateway rule injection via unescaped backticks in HTTPRoute match values | 6.1 | — | 2026-03-12 | |
| CVE-2026-54761 | Traefik: Kubernetes Gateway crossProviderNamespaces bypass allows HTTPRoute outside the allowlist to expose in... | 6.0 | — | 2026-06-24 | |
| CVE-2023-47124 | Denial of service whith ACME HTTPChallenge in Traefik | 5.9 | — | 2023-12-05 | |
| CVE-2026-22045 | Traefik's ACME TLS-ALPN fast path lacks timeouts and close on handshake stall | 5.9 | — | 2026-01-16 | |
| CVE-2026-88879 | Traefik before v2.11.56 Identity Spoofing via Header Alias | 5.3 | — | 2026-09-10 | |
| CVE-2026-88011 | Traefik: ForwardAuth identity spoofing via dot-form header alias | 5.3 | — | 2026-09-11 | |
| CVE-2021-27375 | Traefik before 2.4.5 allows the loading of IFRAME elements from other domains. | 5.3 | — | 2021-02-18 | |
| CVE-2026-33433 | Traefik Vulnerable to BasicAuth/DigestAuth Identity Spoofing via Non-Canonical headerField | 5.1 | — | 2026-03-27 | |
| CVE-2021-32813 | Drop Headers via Malicious Connection Header | 4.8 | — | 2021-08-04 | |
| CVE-2023-47106 | Incorrect processing of fragment in the URL leads to Authorization Bypass in Traefik | 4.8 | — | 2023-12-05 | |
| CVE-2026-41174 | Traefik Kubernetes CRD allows unauthorized cross-namespace middleware binding | 4.8 | — | 2026-05-01 | |
| CVE-2026-71325 | Traefik: `allowCrossNamespace=false` bypass via `@kubernetescrd` TraefikService backendRef | 4.8 | — | 2026-08-07 | |
| CVE-2026-26998 | Traefik: unbounded io.ReadAll on auth server response body causes OOM denial of service(DOS) | 4.4 | — | 2026-03-06 | |
| CVE-2022-23469 | Authorization header displayed in the debug logs | 3.5 | — | 2022-12-09 | |
| CVE-2025-47952 | Traefik allows path traversal using url encoding | 2.9 | — | 2025-05-30 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).